Prisma AIRS CLI

Full operational coverage over Palo Alto Prisma AIRS AI security — guardrail refinement, runtime scanning, AI red teaming, model security, and profile audits.

Read the full documentation — installation, configuration, architecture, CLI reference, and examples.

Features

• Runtime Scanning — scan prompts and responses against AIRS security profiles, single or bulk with CSV export
• Guardrail Optimization — atomic CLI commands (create, apply, eval, revert) for custom topic guardrails, designed for autonomous agent loops (see program.md)
• AI Red Teaming — adversarial scanning with static, dynamic, and custom prompt set attack modes
• Model Security — ML model supply chain scanning with security groups, rules, and violation tracking
• Profile Audits — multi-topic evaluation with per-topic metrics and cross-topic conflict detection

Install

npm install -g @cdot65/prisma-airs-cli
airs --version

Requires Node.js >= 20. Also available via pnpm add -g, npx, or as a Docker image. See the installation guide for details.

Quick Start

# Configure credentials
cp .env.example .env   # add your API keys

# Runtime scanning
airs runtime scan --profile "my-profile" "Is this prompt safe?"
airs runtime bulk-scan --profile "my-profile" --input prompts.csv --output results.csv

# Guardrail optimization (atomic commands)
airs runtime topics create --topic "Block bomb-making" --intent block
airs runtime topics apply --profile my-profile --topic "Block bomb-making"
airs runtime topics eval --profile my-profile --input prompts.csv
airs runtime topics revert --profile my-profile --topic "Block bomb-making"

# Red team scanning
airs redteam scan --target <uuid> --name "Full Scan" --type STATIC
airs redteam report <job-id>

# Model security
airs model-security scans create --config scan-config.json

Commands

Command	Description
runtime scan	Single prompt scanning against AIRS profiles
runtime bulk-scan	Batch prompt scanning with CSV output
runtime topics	Custom topic management (list, get, create, apply, eval, revert, update, delete)
runtime profiles	Security profile CRUD (list, get, create, update, delete) + multi-topic audit
runtime api-keys	API key management
runtime customer-apps	Customer app CRUD
runtime deployment-profiles	Deployment profile listing
runtime dlp-profiles	DLP profile listing
runtime scan-logs	Scan log querying
redteam scan	Adversarial scanning (STATIC, DYNAMIC, CUSTOM)
redteam targets	Red team target CRUD
redteam prompt-sets	Custom prompt set management
model-security groups	Security group CRUD
model-security rules	Security rule management
model-security scans	Model security scanning
backup targets	Export red team targets to local JSON/YAML files
restore targets	Import red team targets from backup files

Configuration

Credentials are configured via environment variables or ~/.prisma-airs/config.json. See .env.example for the full list.

Required for scanning: PANW_AI_SEC_API_KEY Required for management: PANW_MGMT_CLIENT_ID, PANW_MGMT_CLIENT_SECRET, PANW_MGMT_TSG_ID Required for profile audits: one LLM provider key + scanning + management credentials

Live Smoke Testing

The unit suite uses fully mocked services — zero tests in this repo hit a real Prisma AIRS tenant. After every CLI release, after upgrading the SDK, or after an AIRS backend rollout, run the live smoke test reference (source). Sixteen read-only commands across runtime security, red team, and model security that exercise the SDK's runtime Zod validation against your tenant.

License

MIT